Behaviour for supplying the AES-256 keys kura_crypto uses for at-rest field encryption.

A keyring holds one or more 32-byte keys, each tagged with a key_id (0-255). New values are encrypted with the active key; any value can be decrypted by the key whose key_id is embedded in its ciphertext, so rotation is a matter of adding a new key and flipping active - old rows keep decrypting under their original key with no backfill.

The default implementation is kura_keyring_env. A regulated deployment can supply its own module (e.g. reading from a KMS or Vault) by setting {kura, [{keyring, my_keyring}]} in the application environment.